sap audit logs

[#1]

hello SAPers,

i am using r3 4.7. i need to setup audit logs. can any one provide step by step instructions to do that? i would really appreciate.

[Former Member]

Hi Novice,

SAP R/3 supports an internal auditing system, called the Security Audit Log. Each SAP application server maintains a daily audit file. You can specify the name and location of the Security Audit Log using the rsau/local/file profile parameter.

To activate the internal audit system, set the audit log parameters as described in the following table :

Audit Log parameter settings Audit Log Parameter Set value to...

rsau/enable 1

rsau/local/file path to audit log file

rsau/max_diskspace/local maximum space to allocate for the audit files

rsau/selection_slots 3

rec/client ALL

Note:

The rsau/local/file parameter contains the entire path name to the audit logs, as well as the file name. The file name must include + symbols to contain a variable datepart. Do not include a file extension in the file name. See the following examples for clarification.

This example shows a valid path and filename:

/usr/sap/machine1/log/audit_++++++++

This example shows an invalid path and filename; the filename does not include a datepart:

/usr/sap/machine1/log/audit

This example shows an invalid path and filename; the filename includes a file extension:

/usr/sap/machine1/log/audit_++++++++.aud

After you set the audit log profile parameters, start transaction SM19 to specify which events to log in the Audit Security Log.

• if it helpful reward points are appreciated

[Former Member]

Check out the <a href="https://wiki.sdn.sap.com/wiki/x/_so">GRC how-to guides</a> and let me know if the one on <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/a0c5ae74-a3db-2910-3b91-b543b4be056c">table change log details</a> is what you're looking for.

[Former Member]

Where do you want to set up the audit logs on FF?? please mention that.

[Former Member]

i want to set it up in production. what do you mean by FF? thanks for quick response.